O, Qualys. 


QUALYS ANNOUNCES FOURTH QUARTER AND FULL YEAR 2017 FINANCIAL RESULTS 


2017 Revenue Growth of 17% Year-Over-Year; Normalized Growth of 19% Year-Over-Year 
Q4 Revenue Growth of 20% Year-Over-Year; Normalized Growth of 22% Year-Over-Year 
Announces $100 million 2-Year Share Repurchase Program 
Designation of $25 million for Venture Investing 


Foster City, Calif., — Feb. 12, 2018 — Qualys, Inc. (NASDAQ: QLYS), a pioneer and leading provider of cloud- 
based security and compliance solutions, today announced financial results for the fourth quarter and full year 
ended December 31, 2017. For the quarter, the Company reported revenues of $62.9 million, net income under 
Generally Accepted Accounting Principles (“GAAP”) of $2.9 million, non-GAAP net income of $13.0 million, 
Adjusted EBITDA of $23.8 million, GAAP earnings per diluted share of $0.07 and non-GAAP earnings per diluted 
share of $0.32. For the full year ended December 31, 2017, the Company reported revenues of $230.8 million, 
GAAP net income of $40.4 million, non-GAAP net income of $43.5 million, Adjusted EBITDA of $84.9 million, GAAP 
earnings per diluted share of $1.01 and non-GAAP earnings per diluted share of $1.09. 


"We achieved significant milestones in 2017, finishing the year with a strong fourth quarter in terms of revenues and 
operating margins and delivering an impressive suite of new technology and application components to our Cloud 
Platform. We continue to accelerate our product roadmap, most recently signing a term sheet to acquire a company 
in India, which has developed a well architected and comprehensive agent technology for mobile platforms and 
which we plan to integrate into our platform. The scalability, accuracy, immediacy and breadth of our platform helps 
our customers consolidate their security and compliance stack, drastically reducing the cost and complexity 
associated with deploying and maintaining on-premises solutions while helping them to build security into their 
digital transformation initiatives," said Philippe Courtot, chairman and CEO of Qualys. "We ended 2017 with record 
operating margins and because of our highly cash-generative model, we are also pleased to announce a $100 
million share repurchase program to offset dilution from employee grants and M&A as well as $25 million 
designated for venture investing." 


Fourth Quarter 2017 Financial Highlights 


Revenues: Revenues for the fourth quarter of 2017 increased by 20% to $62.9 million compared to $52.2 million 
for the same quarter in 2016. Normalized for the impact of FX (foreign exchange) and the MSSP (Managed Security 
Service Provider) contract, revenues increased by 22% over the same quarter in 2016. 


Gross Profit: GAAP gross profit for the fourth quarter of 2017 increased by 20% to $48.5 million compared to 
$40.4 million for the same quarter in 2016. GAAP gross margin percentage was 77% for the fourth quarter of 2017 
compared to 77% for the same quarter in 2016. Non-GAAP gross profit for the fourth quarter of 2017 increased by 
21% to $49.5 million compared to $40.9 million for the same quarter in 2016. Non-GAAP gross margin percentage 
was 79% for the fourth quarter of 2017 compared to 78% for the same quarter in 2016. 


Operating Income: GAAP operating income for the fourth quarter of 2017 was $9.7 million compared to $8.8 
million for the same quarter in 2016. Non-GAAP operating income for the fourth quarter of 2017 was $18.6 million 
compared to $13.8 million for the same quarter in 2016. 


Net Income: GAAP net income for the fourth quarter of 2017 was $2.9 million, or $0.07 per diluted share, 
compared to $5.9 million, or $0.15 per diluted share, for the same quarter in 2016. Due to the U.S. Tax Cuts and 
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Jobs Act, GAAP net income for the fourth quarter of 2017 includes a $10.4 million tax expense for the reduction in 
the value of Qualys’ U.S. deferred tax assets caused by the U.S. corporate tax rate reduction. Non-GAAP net 
income for the fourth quarter of 2017 was $13.0 million, or $0.32 per diluted share, compared to non-GAAP net 
income of $8.8 million, or $0.23 per diluted share, for the same quarter in 2016. 


Adjusted EBITDA: Adjusted EBITDA (a non-GAAP financial measure) for the fourth quarter of 2017 increased by 
29% to $23.8 million compared to $18.5 million for the same quarter in 2016. As a percentage of revenues, 
Adjusted EBITDA was 38% for the fourth quarter of 2017 compared to 35% for the same quarter in 2016. 


Fourth Quarter 2017 Business Highlights 


Select New Customers: 
e Adventist Health System, Brigham Young University, Celestica Inc., London Metal Exchange, Penguin 
Random House, Progressive Insurance, Qatar Petrochemical Company (QAPCO), Quanta Services, Western 
Digital Corporation. 


Business Highlights: 

e Announced the acquisition of NetWatcher: NetWatcher will provide significant domain expertise in building and 
delivering cybersecurity and real-time threat intelligence offerings. NetWatcher's technology combines asset 
discovery, vulnerability management, intrusion detection, behavioral monitoring, Security Information and 
Event Management (SIEM), log management and continuous threat intelligence all-in-one solution that looks 
for anomalous behavior 24x7 and provides businesses with a real-time view of the security posture of assets, 
including weak passwords, unsafe behavior, and outdated software. 

e Announced a partnership with STC Solutions: STC Solutions will integrate and deliver the Qualys Private 
Cloud Platform and suite of Qualys Cloud Apps from STC Solutions’ data center in Riyadh to expand its 
managed security services offerings and allow Saudi Arabian enterprises to consolidate a full range of security 
and compliance solutions in a single-pane-of-glass view. 


Full Year 2017 Financial Highlights 


Revenues: Revenues for 2017 increased by 17% to $230.8 million compared to $197.9 million for 2016. 
Normalized for the impact of FX (foreign exchange) and the MSSP (Managed Security Service Provider) contract, 
revenues increased by 19% over 2016. 


Gross Profit: GAAP gross profit for 2017 increased by 16% to $179.2 million compared to $154.8 million for 2016. 
GAAP gross margin percentage was 78% for 2017 compared to 78% for 2016. Non-GAAP gross profit increased by 
16% to $181.9 million for 2017 compared to $156.7 million for 2016. Non-GAAP gross margin percentage was 79% 
for 2017 compared to 79% for 2016. 


Operating Income: GAAP operating income for 2017 was $37.2 million compared to $30.1 million for 2016. Non- 
GAAP operating income for 2017 was $64.8 million compared to $51.0 million for 2016. 


Net Income: GAAP net income for 2017 was $40.4 million, or $1.01 per diluted share, compared to $19.2 million, 
or $0.50 per diluted share, for 2016. Non-GAAP net income for 2017 was $43.5 million, or $1.09 per diluted share, 
compared to non-GAAP net income of $32.8 million, or $0.86 per diluted share, for 2016. 


Adjusted EBITDA: Adjusted EBITDA (a non-GAAP financial measure) for 2017 increased by 25% to $84.9 million 
compared to $68.0 million for 2016. As a percentage of revenues, Adjusted EBITDA was 37% for 2017 compared to 
34% for 2016. 


Full Year 2017 Business Highlights 


Market Recognition 


Recognized by IDC as the market-share leader in the $1.7 billion Worldwide Vulnerability Assessment Market 
— which is comprised of the Worldwide Device Vulnerability Assessment Market and Application Security 
Market segments. 

Recognized by Frost and Sullivan with the 2017 Global Vulnerability Management Market Leadership Award, 
highlighting the Company's areas of excellence in growth strategy, product quality, customer ownership 
experience, and technology leverage. 


Business Development 


Announced the acquisition of Pune, India-based Nevis Networks, expanding Qualys' domain expertise in 
passive scanning and deep packet inspection as well as accelerating its entrance into the mitigation and 
response market segment, natively from the Qualys Cloud Platform. 

Announced an expanded partnership with IBM that will add Qualys' continuous cloud-based IT security and 
compliance solutions to its Managed Security Services portfolio. Launched a new Qualys App for IBM's 
QRadar Security Intelligence Platform that allows customers to visualize their network IT assets and 
vulnerabilities in real-time. 

Announced an extension of Qualys’ single-pane view of security and compliance posture into Google Cloud 
Platform (GCP). Qualys Virtual Scanner Appliance (QVSA) can now be directly deployed from the Google 
Cloud Launcher to GCP. This will provide customers with continuous security and visibility for their global IT 
assets whether on-premises or in the cloud. 

Announced a partnership with Bugcrowd allowing joint customers the ability to share vulnerability data across 
automated web application scanning and crowdsourced bug bounty programs. 


Products & Features 


Unveiled new Qualys positioning and logo refresh, highlighting the new unified and simplified approach to 

prevention and response the Qualys Cloud Platform and its Cloud Apps bring to the market. 

- Unveiled CloudView App Framework, which gives customers the full insight across all their cloud 
environments — inventory, configuration, and continuous view of their security and compliance postures — 
and showcased its first two components, Cloud Inventory (Cl) and Cloud Security Assessment (CSA). 
Currently in beta. 

- Unveiled CertView App Framework, which provides discovery and management of digital certificates, and 
showcased its first two components, Certificate Inventory (CRI) and Certificate Assessment (CRA). 
Currently in beta. 

- Unveiled Container Security, a new cloud-based Qualys solution that enables customers to address 
security for containers in their DevOps pipeline and deployments across cloud and on-premises 
environments. Currently in beta. 

Launched new disruptive services: 

- File Integrity Monitoring (FIM): Logs and centrally tracks file change events across global IT systems and a 
variety of enterprise operating systems to provide customers a simple way to achieve centralized cloud- 
based visibility of activity resulting from normal patching and administrative tasks, change control 
exceptions or violations, or malicious activity — then report on that system activity as part of compliance 
mandates. 

- Indication of Compromise (IOC): Expands the capabilities of the Qualys Cloud Platform to deliver threat 
hunting, detect suspicious activity, and confirm the presence of known and unknown malware for devices 
both on and off the network. 

- Security Configuration Assessment (SCA): Allows customers to expand their vulnerability management 
program with configuration scanning capabilities and simplified workflows to assess, report, monitor, and 
remediate security-related configuration issues based on the CIS benchmark. 
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e Announced new functionalities in Qualys Web Application Security offerings, including scalable fast scanning, 
detection and patching of websites, mobile applications and Application Programming Interfaces (APIs) in one 
unified platform. 

e Released purpose-built content, workflows, and reporting in Qualys Cloud Platform to provide customers with 
continuous IT asset visibility, data collection and risk evaluation for compliance with the European Union (EU) 
General Data Protection Regulation (GDPR). 

e Announced that the FedRAMP-certified Qualys Cloud Platform now supports the requirements laid out in the 
2017 White House Executive Order (EO) on Strengthening the Cybersecurity of Federal Networks and Critical 
Infrastructure. 


Financial Performance Outlook 

The outlook provided below is on an ASC Topic 606 basis, which Qualys is adopting for its fiscal year 2018 using 
the modified retrospective transition method. The most significant impact of the standard relates to the potential 
deferral of sales commissions and contract costs. 


First Quarter 2018 Guidance: Management expects revenues for the first quarter of 2018 to be in the range of 
$63.4 million to $64.1 million, representing 19% to 21% growth over the same quarter in 2017. GAAP net income 
per diluted share is expected to be in the range of $0.13 to $0.15, which assumes an effective income tax rate of 
27%. Non-GAAP net income per diluted share is expected to be in the range of $0.32 to $0.34, which assumes an 
effective non-GAAP income tax rate of 23%. First quarter 2018 EPS estimates are based on approximately 41.6 
million weighted average diluted shares outstanding for the quarter. 


Full Year 2018 Guidance: Management expects revenues for the full year 2018 to be in the range of $275.5 million 
to $278.5 million, representing 19% to 21% growth over 2017. GAAP net income per diluted share is expected to be 
in the range of $0.71 to $0.76, which assumes an effective income tax rate of 27%. Non-GAAP net income per 
diluted share is expected to be in the range of $1.39 to $1.44, which assumes an effective non-GAAP income tax 
rate of 23%. Full year 2018 EPS estimates are based on approximately 42.0 million weighted average diluted 
shares outstanding. 


Investor Conference Call 


Qualys will host a conference call and live webcast to discuss its fourth quarter and full year 2017 financial results 
at 5:00 p.m. Eastern Time (2:00 p.m. Pacific Time) on Monday, Feb. 12, 2018. To access the conference call, dial 
(877) 881-2609 in the U.S. or +1 (970) 315-0463 for international participants with conference ID # 4869758. The 
live webcast of Qualys' earnings conference call, investor presentation, and prepared remarks can also be 
accessed at https://investor.qualys.com/events.cfm. A replay of the conference call will be available through the 
same webcast link following the end of the call. 


Investor Contact 


Joo Mi Kim 
Vice President, FP&A and Investor Relations 
(650) 801-6100 


ir@qualys.com 


About Qualys, Inc. 


Qualys, Inc. (NASDAQ: QLYS) is a pioneer and leading provider of cloud-based security and compliance solutions 
with over 10,300 customers in more than 130 countries, including a majority of each of the Forbes Global 100 and 
Fortune 100. Qualys helps organizations streamline and consolidate their security and compliance solutions in a 


single platform and build security into digital transformation initiatives for greater agility, better business outcomes 
and substantial cost savings. The Qualys Cloud Platform and its integrated Cloud Apps deliver businesses critical 
security intelligence continuously, enabling them to automate the full spectrum of auditing, compliance and 
protection for IT systems and web applications on premises, on endpoints and elastic clouds. Founded in 1999 as 
one of the first SaaS security companies, Qualys has established strategic partnerships with leading managed 
service providers and consulting organizations including Accenture, BT, Cognizant Technology Solutions, Deutsche 
Telekom, Fujitsu, HCL Technologies, DXC Technology, IBM, Infosys, NTT, Optiv, SecureWorks, Tata 
Communications, Verizon, and Wipro. The Company is also a founding member of the Cloud Security Alliance. For 
more information, please visit www.qualys.com. 


Qualys and the Qualys logo are proprietary trademarks of Qualys, Inc. All other products or names may be 
trademarks of their respective companies. 


Legal Notice Regarding Forward-Looking Statements 


This press release contains forward-looking statements within the meaning of Section 27A of the Securities Act of 
1933 and Section 21E of the Securities Exchange Act of 1934. Forward-looking statements generally relate to 
future events or our future financial or operating performance. Forward-looking statements in this press release 
include, but are not limited to, statements related to: acceleration of our product roadmap with the signing of a term 
sheet to acquire a company in India which has developed agent technology for mobile platforms which we plan to 
integrate into our platform; our ability to maintain leadership in securing global IT environments and helping 
customers secure their digital transformation initiatives; the growth of our business, including adoption of our 
existing solutions and our new offerings to both existing and new customers; our expectations regarding the 
introduction of new solutions; the capabilities of our platform; the expansion of our partnerships and the related 
benefits of such partnerships; our strategy and our business model and our ability to execute such strategy; our 
share repurchase program and allocation of cash for venture investments; our guidance for revenues, GAAP EPS 
and non-GAAP EPS for the first quarter and full year 2018, and our expectations for the number of weighted 
average diluted shares outstanding and effective income tax rate for the first quarter and full year 2018. Our 
expectations and beliefs regarding these matters may not materialize, and actual results in future periods are 
subject to risks and uncertainties that could cause actual results to differ materially from those projected. These 
risks include our ability to negotiate and execute a definitive agreement to acquire the aforementioned company in 
India which has developed agent technology for mobile platforms, and to consummate such transaction and 
successfully integrate this company; our ability to continue to develop platform capabilities and solutions; the ability 
of our platform and solutions to perform as intended; customer acceptance and purchase of our existing solutions 
and new solutions; real or perceived defects, errors or vulnerabilities in our products or services; our ability to retain 
existing customers and generate new customers; the budgeting cycles, seasonal buying patterns and length of our 
sales cycle; our ability to manage costs as we increase our customer base and the number of our platform 
solutions; the market for cloud solutions for IT security and compliance not increasing at the rate we expect; 
competition from other products and services; fluctuations in currency exchange rates, unexpected fluctuations in 
our effective tax rate on a GAAP and non-GAAP basis, our ability to effectively manage our rapid growth and our 
ability to anticipate future market needs and opportunities; any unanticipated accounting charges; and general 
market, political, economic and business conditions in the United States as well as globally. The forward-looking 
statements contained in this press release are also subject to other risks and uncertainties, including those more 
fully described in our filings with the Securities and Exchange Commission, including our Quarterly Report on Form 
10-Q for the quarter ended September 30, 2017, filed with the Securities and Exchange Commission on November 
3, 2017. 


The forward-looking statements in this press release are based on information available to Qualys as of the date 
hereof, and Qualys disclaims any obligation to update any forward-looking statements, except as required by law. 


Non-GAAP Financial Measures 


In addition to reporting financial results in accordance with generally accepted accounting principles, or GAAP, 
Qualys monitors operating measures of non-GAAP gross profit, non-GAAP gross margin, non-GAAP operating 
expenses, non-GAAP operating income, non-GAAP net income, and non-GAAP net income per diluted share. In 
computing these non-GAAP financial measures, Qualys excludes the effects of stock-based compensation 
expense, non-recurring expenses and acquisition-related expenses that do not reflect ongoing costs of operating 
the business. Qualys also monitors Adjusted EBITDA (defined as earnings before interest, taxes, depreciation, 
amortization, stock-based compensation, other (income) expense, net, non-recurring expenses, and acquisition- 
related expenses that do not reflect ongoing costs of operating the business). Estimated impact of the MSSP 
contract signed in February 2016 refers to the difference between the estimated revenue recognized under the new 
terms in the MSSP contract and the estimated revenue that would have been recognized without the MSSP 
contract, assuming an appropriate renewal rate. The percentage impact is the net benefit, only in the contract year 
in which it occurred. Qualys believes that these non-GAAP operating metrics help illustrate underlying trends in its 
business that could otherwise be masked by the effect of the income or expenses, as well as the related tax effects, 
that are excluded in non-GAAP gross profit, non-GAAP gross margin, non-GAAP operating expenses, non-GAAP 
operating income, non-GAAP net income, non-GAAP net income per diluted share and Adjusted EBITDA. 


Furthermore, Qualys uses these operating measures to establish budgets and operational goals for managing its 
business and evaluating its performance. Qualys believes that non-GAAP gross profit, non-GAAP gross margin, 
non-GAAP operating expenses, non-GAAP operating income, non-GAAP net income, non-GAAP net income per 
diluted share, and Adjusted EBITDA provide additional tools for investors to use in comparing its recurring core 
business operating results over multiple periods with other companies in its industry. Non-GAAP net income and 
non-GAAP net income per diluted share for the twelve months ended December 31, 2016 excludes $0.7 million of 
non-recurring expenses related to the remittance of payroll taxes from year 2013 through May 2016. Non-GAAP net 
income and non-GAAP net income per diluted share for the twelve months ended December 31, 2017 excludes 
$0.5 million of amortization of intangibles from acquisitions of Nevis Networks and NetWatcher and $0.1 million of 
compensation expense from the acquisition of NetWatcher that do not reflect ongoing costs of operating the 
business. During this same period, the Company has not excluded amounts related to other non-recurring items 
from non-GAAP net income because the Company has considered such amounts to be immaterial in any given 
quarter during such period. 


Qualys has not reconciled non-GAAP net income per diluted share guidance to GAAP net income per diluted share 
because Qualys does not provide guidance on the various reconciling cash and non-cash items between GAAP net 
income and non-GAAP net income (i.e., stock-based compensation and non-recurring expenses). The actual dollar 
amount of reconciling items in the first quarter and full year 2018 is likely to have a significant impact on the 
Company’s GAAP net income per diluted share in the first quarter and full year 2018. Accordingly, a reconciliation 
of the non-GAAP net income per diluted share guidance to the GAAP net income per diluted share guidance is not 
available without unreasonable effort. 


In order to provide a more complete picture of recurring core operating business results, the Company’s non-GAAP 
net income and non-GAAP net income per diluted share include tax adjustments required to achieve the effective 
tax rate on a non-GAAP basis, which could differ from the GAAP effective tax rate. The Company’s non-GAAP 
effective tax rate was 35% for the full year 2017 (estimated rate was calculated as 36% in each of our first three 
quarters of fiscal 2017). The Company believes its estimated non-GAAP effective tax rate of 23% in 2018 is a 
reasonable estimate under its global operating structure. The Company intends to re-evaluate the non-GAAP 
effective tax rate on an annual basis. However, it may adjust this rate during the year to take into account events or 
trends that it believes materially impact the estimated annual rate. The non-GAAP effective tax rate could be 
subject to change for a number of reasons, including but not limited to, significant changes resulting from tax 
legislation, material changes in geographic mix of revenues and expenses and other significant events. 


The presentation of this non-GAAP financial information is not intended to be considered in isolation or as a 
substitute for results prepared in accordance with GAAP. A reconciliation of the non-GAAP financial measures 
discussed in this press release to the most directly comparable GAAP financial measures is included with the 
financial statements contained in this press release. Management uses both GAAP and non-GAAP information in 
evaluating and operating its business internally and as such has determined that it is important to provide this 
information to investors. 


Qualys, Inc. 
CONDENSED CONSOLIDATED STATEMENTS OF OPERATIONS 


(Unaudited) 
(in thousands, except per share data) 


Revenues 
Cost of revenues 

Gross profit 
Operating expenses: 

Research and development “) 

Sales and marketing 

General and administrative 

Total operating expenses 

Income from operations 
Other income (expense), net: 

Interest expense 

Interest income 

Other expense, net 

Total other income (expense), net 

Income before income taxes 
Provision (benefit from) for income taxes 
Net income 
Net income per share: 

Basic 

Diluted 


Weighted average shares used in computing net income per 
share: 
Basic 


Diluted 


© Includes stock-based compensation as follows: 


Cost of revenues 

Research and development 
Sales and marketing 
General and administrative 


Total stock-based compensation 


Three Months En 
December 31, 


ded 


Year Ended 
December 31, 


2017 2016 2017 2016 

$ 62,915 $ 52,224 $ 230,828 $ 197,925 
14,405 11,852 51,580 43,128 

48,510 40,372 179,248 154,797 

11,576 9,238 42,816 36,591 

16,983 15,592 63,855 58,985 

10,222 6,731 35,334 29,114 

38,781 31,561 142,005 124,690 

9,729 8,811 37,243 30,107 

= (3) (3) (26) 

899 417 2,674 1,320 

(247) (530) (536) (972) 

652 (116) 2,135 322 

10,381 8,695 39,378 30,429 

7,524 2,788 (1,062) 11,205 

$ 2,857 $ 5,907 $ 40,440 $ 19,224 
0.07 0.17 1.08 $ 0.55 

0.07 0.15 1.01 $ 0.50 

38,278 35,762 37,443 35,247 

41,186 39,002 40,071 38,369 

$ 590 $ 540 $ 2,159 $ 1,858 
1,715 1,305 5,944 5,678 

1,311 1,411 4,755 4,870 

4,823 1,771 14,103 7,743 

$ 8,439 $ 5,027 $ 26,961 $ 20,149 


Qualys, Inc. 

CONDENSED CONSOLIDATED STATEMENTS OF COMPREHENSIVE INCOME 
(Unaudited) 

(in thousands) 


Net income 
Available-for-sale investments: 


Change in net unrealized loss on investments, net of tax 


Less: reclassification adjustment for net realized gain included in 
net income, net of tax 


Other comprehensive (loss) income, net 


Comprehensive income 


Three Months Ended 


2017 


December 31, 


2,857 $ 


(493) 
40 
(453) 


2,404 $ 


2016 


5,907 $ 


(198) 
25 
(173) 


5,734 $ 


Year Ended 
December 31, 
2017 


40,440 $ 


(462) 
44 
(418) 


40,022 $ 


2016 


19,224 


(57) 
112 
55 


19,279 


CONDENSED CONSOLIDATED BALANCE SHEETS 


Assets 
Current assets: 
Cash and cash equivalents 
Short-term investments 
Accounts receivable, net 
Prepaid expenses and other current assets 
Total current assets 
Long-term investments 
Property and equipment, net 
Deferred tax assets, net 
Intangible assets, net 
Goodwill 
Restricted cash 
Other noncurrent assets 
Total assets 


Liabilities and Stockholders’ Equity 
Current liabilities: 


Accounts payable 
Accrued liabilities 
Deferred revenues, current 
Total current liabilities 
Deferred revenues, noncurrent 
Other noncurrent liabilities 
Total liabilities 
Stockholders’ equity: 
Common stock 
Additional paid-in capital 
Accumulated other comprehensive loss 
Retained earnings (accumulated deficit) 
Total stockholders’ equity 
Total liabilities and stockholders’ equity 


Qualys, Inc. 


(Unaudited) 
(in thousands) 
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December 31, 


2017 2016 
86,591 $ 86,737 
201,823 157,119 
64,412 47,024 
16,524 9,808 
369,350 300,688 
67,224 45,725 
58,557 39,401 
25,066 16,590 
12,401 987 

1,549 317 
1,200 1,200 
2,178 2,096 
537,525 $ 407,004 
1,144 $ 2,051 
21,444 13,317 
143,186 114,964 
165,774 130,332 
17,136 15,528 
11,071 2,731 
193,981 148,591 
39 36 
304,155 266,794 
(574) (156) 
39,924 (8,261) 
343,544 258,413 
537,525 $ 407,004 


Qualys, Inc. 
CONDENSED CONSOLIDATED STATEMENTS OF CASH FLOWS 
(Unaudited) 
(in thousands) 


Year Ended December 31, 
2017 2016 
Cash flows from operating activities: 
Net income $ 40,440 $ 19,224 
Adjustments to reconcile net income to net cash provided by operating activities: 


Depreciation and amortization expense 20,636 16,994 
Bad debt expense 657 199 
Loss on disposal of property and equipment 161 55 
Stock-based compensation 26,961 20,149 
Amortization of premiums and accretion of discounts on investments 1,324 1,000 
Excess tax benefits from stock-based compensation — (8,700) 
Deferred income taxes (10,414) (440) 
Excess tax benefits included in deferred tax assets 7,696 — 


Changes in operating assets and liabilities: 


Accounts receivable (17,966) (4,898) 
Prepaid expenses and other assets (53) (2,107) 
Restricted cash — (1,200) 
Accounts payable (454) (1,220) 

Accrued liabilities 1,485 9,696 

Deferred revenues 29,830 17,903 

Other noncurrent liabilities 7,343 1,455 

Net cash provided by operating activities 107,646 68,110 

Cash flows from investing activities: 
Purchases of investments (299,891) (222,953) 
Sales and maturities of investments 231,996 149,708 
Purchases of property and equipment (37,818) (23,245) 
Purchase of business (12,482) = 
Net cash used in investing activities (118,195) (96,490) 
Cash flows from financing activities: 

Proceeds from exercise of stock options 31,327 15,157 
Excess tax benefits from stock-based compensation — 8,700 
Payments for taxes related to employee net share settlement of equity awards (20,924) (438) 
Net cash provided by financing activities 10,403 23,419 

Net decrease in cash and cash equivalents (146) (4,961) 
Cash and cash equivalents at beginning of period 86,737 91,698 
Cash and cash equivalents at end of period $ 86,591 $ 86,737 
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Qualys, Inc. 

RECONCILIATION OF NON-GAAP DISCLOSURES 
EBITDA AND ADJUSTED EBITDA 
(Unaudited) 

(in thousands) 


Three Months Ended Year Ended 
December 31, December 31, 
2017 2016 2017 2016 
Net income $ 2,857 $ 5,907 $ 40,440 $ 19,224 
Depreciation and amortization of property and equipment 5,166 4,586 19,828 16,621 
Amortization of intangible assets 416 44 808 373 
Interest expense — 3 3 26 
Provision (benefit from) for income taxes 7,524 2,788 (1,062) 11,205 
EBITDA 15,963 13,328 60,017 47,449 
Stock-based compensation 8,439 5,027 26,961 20,149 
Other (income) expense, net (652) 113 (2,138) (348) 
Acquisition-related expense 93 = 93 = 
One-time tax related expense — — — 716 
Adjusted EBITDA $ 23843 $ 18468 $ 84,933 $ 67,966 
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Qualys, Inc. 
RECONCILIATION OF NON-GAAP DISCLOSURES 
(Unaudited) 
(in thousands, except per share data) 


Three Months Ended Year Ended 
December 31, December 31, 
2017 2016 2017 2016 
GAAP Cost of revenues $ 14,405 $ 11,852 $ 51,580 $ 43,128 
Less: Stock-based compensation (590) (540) (2,159) (1,858) 
Less: Intangible asset amortization (1) (374) = (460) = 
Non-GAAP Cost of revenues $ 13,441 $ 11,312 $ 48,961 $ 41,270 
GAAP Gross profit $ 48,510 $ 40,372 $ 179,248 $ 154,797 
Plus: Stock-based compensation 590 540 2,159 1,858 
Plus: Intangible asset amortization (1) 374 — 460 — 
Non-GAAP Gross profit $ 49,474 $ 40,912 $ 181,867 $ 156,655 
GAAP Research and development $ 11,576 $ 9,238 $ 42,816 $ 36,591 
Less: Stock-based compensation (1,715) (1,305) (5,944) (5,678) 
Less: Acquisition-related expense (2) (14) — (14) — 
Non-GAAP Research and development $ 9,847 $ 7,933 $ 36,858 $ 30,913 
GAAP Sales and marketing $ 16,983 $ 15,592 $ 63,855 $ 58,985 
Less: Stock-based compensation (1,311) (1,411) (4,755) (4,870) 
Less: Acquisition-related expense (2) (79) Z (79) = 
Non-GAAP Sales and marketing $ 15,593 $ 14,181 $ 59,021 $ 54,115 
GAAP General and administrative $ 10,222 $ 6,731 $ 35,334 $ 29,114 
Less: Stock-based compensation (4,823) (1,771) (14,103) (7,743) 
Less: One-time tax related expense — — — (716) 
Non-GAAP General and administrative $ 5,399 $ 4,960 $ 21,231 $ 20,655 
GAAP Operating expenses $ 38,781 $ 31,561 $ 142,005 $ 124,690 
Less: Stock-based compensation (7,849) (4,487) (24,802) (18,291) 
Less: Acquisition-related expense (2) (93) = (93) = 
Less: One-time tax related expense — — — (716) 
Non-GAAP Operating expenses $ 30,839 $ 27,074 $ 117,110 $ 105,683 
GAAP Income from operations $ 9,729 $ 8,811 $ 37,243 $ 30,107 
Plus: Stock-based compensation 8,439 5,027 26,961 20,149 
Plus: Intangible asset amortization (1) 374 — 460 — 
Plus: Acquisition-related expense (2) 93 = 93 = 
Plus: One-time tax related expense — — — 716 
Non-GAAP Income from operations $ 18,635 $ 13,838 $ 64,757 $ 50,972 
GAAP Net income $ 2,857 $ 5,907 $ 40,440 $ 19,224 
Plus: Stock-based compensation 8,439 5,027 26,961 20,149 
Plus: Intangible asset amortization (1) 374 — 460 — 
Plus: Acquisition-related expense (2) 93 — 93 — 
Plus: One-time tax related expense — — — 716 
Less: Tax adjustment 1,250 (2,152) (24,474) (7,261) 
Non-GAAP Net income $ 13,013 $ 8,782 $ 43,480 $ 32,828 
Non-GAAP Net income per share: 
Basic $ 0.34 $ 0.25 $ 1.16 $ 0.93 
Diluted $ 0.32 $ 0.23 $ 1.09 $ 0.86 
Weighted average shares used in non-GAAP net income per share: 
Basic 38,278 35,762 37,443 35,247 
Diluted 41,186 39,002 40,071 38,369 


Note (1): Includes amortization of intangible assets from acquisition of Nevis Networks and NetWatcher. 


Note (2): Relates to compensation expense from the acquisition of NetWatcher. 
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Qualys, Inc. 
RECONCILIATION OF NON-GAAP DISCLOSURES 
FREE CASH FLOWS 
(Unaudited) 
(in thousands) 


Year Ended December 31, 


2017 2016 
GAAP Cash flows provided by operating activities $ 107,646 $ 68,110 
Less: 
Purchases of property and equipment (37,818) (23,245) 
Non-GAAP Free cash flows $ 69,828 $ 44,865 
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Qualys, Inc. 


RECONCILIATION OF NON-GAAP DISCLOSURES 


CALCULATED CURRENT BILLINGS 


(Unaudited) 
(in thousands) 


Q4 GAAP Revenue 
Plus: Current Deferred Revenue at December 31 
Less: Current Deferred Revenue at September 30 
Non-GAAP Q4 Calculated Current Billings 


Calculated Current Billings Growth Compared to Same Period of Prior Year 
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Three Months Ended December 31, 


2017 2016 
$ 62,915 $ 52,224 
143,186 114,964 
(132,167) (109,026) 
$ 73,934 $ 58,162 


Qualys, Inc. 
RECONCILIATION OF U.S. GAAP REVENUE GROWTH AND CURRENT DEFERRED REVENUE GROWTH TO 
NORMALIZED GROWTH 
(Unaudited) 
(in thousands) 


Reconciliation of U.S. GAAP Revenue Growth to Normalized Growth 


Three Months Ended Year Ended 
December 31, December 31, 
2017 2016 2017 2016 
Revenues $ 62,915 $ 52,224 $ 230,828 $ 197,925 
Y/Y Revenue Change as Reported Under U.S. GAAP 20.5% 17.5 % 16.6% 20.5 % 
Plus: Impact of MSSP Contract Signed in Feb 2016 0.6% (0.8)% 1.6% (2.0)% 
Plus: Foreign Exchange Impact 0.7% 1.2% 1.1% 1.6 % 
Normalized Revenue Growth 21.8% 17.9 % 19.3% 20.2 % 


Reconciliation of U.S. GAAP Current Deferred Revenue Growth to Normalized Growth 


As of December 31, 2017 


Current Deferred Revenue $ 143,186 

Y/Y Current Deferred Revenue Change as Reported Under U.S. GAAP 24.5 % 
Plus: Foreign Exchange Impact (0.6)% 
Normalized Current Deferred Revenue Growth 23.9 % 


Source: Qualys 
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